Certificate Revocation/Expiry Status Verification

This chapter provides a brief overview of how to check the status of the certificates generated for sessionsin Cisco Unified Communications Manager Administration. The certificate service periodically checks forlong lived sessions between Cisco Unified CommunicationsManager and other services. Long lived sessionshave duration of six hours or more. The check is performed for the following long lived sessions:

• CTI Connections with JTAPI /TAPI applications.

• LDAP Connection between Cisco Unified Communications Manager and SunOne servers.

• IPSec Connections

It also describes how to configure the enterprise parameter for verifying certificate revocation and expiry.

The enterprise parameterCertificate Revocation and Expiry allows you to control the certificate validationchecks. The revocation and expiry check parameter is enabled on the Enterprise Parameter page of CiscoUnified Communications Manager. The certificate expiry for the long lived sessions is not verified, whenthe enterprise parameter value is disabled.

The certificate revocation service is active for LDAP and IPSec connections, when the Enable Revocationis selected on theOperating SystemAdministration of CiscoUnified CommunicationsManager and revocationand expiry check parameter is set to enabled. The periodicity of the check for IPSec connections are basedon theCheck Every value. The revocation check for the certificate is not performed, if theEnable Revocationcheck box is unchecked.

• Certificate Revocation/Expiry Status Verification, page 1

• Verify Certificate Status, page 2

• Support for Delegated Trust Model in OCSP Response, page 2

Certificate Revocation/Expiry Status VerificationThis chapter provides a brief overview of how to check the status of the certificates generated for sessions inCisco Unified Communications Manager Administration. The certificate service periodically checks for longlived sessions between Cisco Unified Communications Manager and other services. Long lived sessions haveduration of six hours or more. The check is performed for the following long lived sessions:

• CTI Connections with JTAPI /TAPI applications.

Security Guide for Cisco Unified Communications Manager, Release 11.0(1) 1

• LDAP Connection between Cisco Unified Communications Manager and SunOne servers.

• IPSec Connections

It also describes how to configure the enterprise parameter for verifying certificate revocation and expiry.

The enterprise parameter Certificate Revocation and Expiry allows you to control the certificate validationchecks. The revocation and expiry check parameter is enabled on the Enterprise Parameter page of CiscoUnified Communications Manager. The certificate expiry for the long lived sessions is not verified, when theenterprise parameter value is disabled.

The certificate revocation service is active for LDAP and IPSec connections, when the Enable Revocationis selected on the Operating SystemAdministration of Cisco Unified CommunicationsManager and revocationand expiry check parameter is set to enabled. The periodicity of the check for IPSec connections are basedon theCheck Every value. The revocation check for the certificate is not performed, if theEnable Revocationcheck box is unchecked.

Verify Certificate StatusThe following procedure provides the tasks that you perform to enable or disable the certificate validity check.

Procedure

Step 1 In Cisco Unified Communications Manager Administration, choose System > Enterprise ParametersThe Enterprise Parameters Configuration window displays.

Step 2 Under Certificate Revocation and Expiry section,a) From the Certificate Validity Check drop-down list box, select Enabled to enable the validity check.b) Enter the Validity Check Frequency (hours) value.

The default value is 24 hours. The minimum value is 6 hours and the maximum value is 576 hours.

Step 3 Click Save.Step 4 Click Apply Config.

The Apply Configuration Information dialog displays.

Step 5 Click Ok.The timers for DIRSYNC and CTI are restarted.

Support for Delegated Trust Model in OCSP ResponseOnline Certificate Status Protocol (OCSP) allows a device to obtain real-time information about the status ofa given certificate. Examples of certificate status are Good, Revoked, and Unknown.

Cisco Unified Communications Manager uses OCSP to validate third-party certificates that are uploaded intothe Cisco Unified Communications Manager trust store. Cisco Unified Communications Manager requiresan OCSP Responder URL to connect to the OCSP responder server over HTTP. It sends an HTTP request tothe responder to validate a certificate.

Security Guide for Cisco Unified Communications Manager, Release 11.0(1)2

Certificate Revocation/Expiry Status VerificationVerify Certificate Status

Cisco Unified Communications Manager currently supports the Trusted Responder Model of OCSP, wherethe OCSP response is signed by a self-signed certificate of the OCSP server. This self-signed certificate isuploaded to the trust store before initiating an OCSP request. This certificate is used to verify the signatureon the OCSP response.

Cisco Unified Communications Manager 11.0 and later support the Delegated Trust Model (DTM) of theOCSP responder, where the OCSP responses are no longer approved by the self-signed certificate but areissued by a Certificate Authority (Root CA or Subordinate CA). The CA certificate validates the OCSPresponder certificates. The CA certificate that issued the OCSP responder certificate in Cisco UnifiedCommunications Manager trust store is required, instead of OCSP response signing certificate. When youreceive an OCSP response, the CA's certificate is used to validate the signature in the response.

In case of a DTM execution failure, the OCSP response is verified using the self-signed certificate.Note

Security Guide for Cisco Unified Communications Manager, Release 11.0(1) 3

Certificate Revocation/Expiry Status VerificationSupport for Delegated Trust Model in OCSP Response

Security Guide for Cisco Unified Communications Manager, Release 11.0(1)4

Certificate Revocation/Expiry Status VerificationSupport for Delegated Trust Model in OCSP Response